CVE-2026-53954

Bugsink is a self-hosted error tracking tool. Prior to version 2.2.2, Bugsink stores every set of custom tags supplied with an incoming event, allowing a caller with a valid project DSN to submit an unusually large tag set and force excessive tag-row writes. Because Bugsink uses a single-writer database architecture, the expensive write transaction delays digestion of other events and causes a temporary ingestion denial of service. Version 2.2.2 applies the configurable MAX_EVENT_TAGS limit before storage. The impact is limited to availability for an instance accepting the event and does not expose stored data, modify existing events, or allow code execution. This issue is fixed in version 2.2.2.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/bugsink/bugsink/commit/1d0539fefcd1a796143d15d84053b1c0122ef8c7
https://github.com/bugsink/bugsink/commit/8dca571b9e66c535ed4885465db820824e7c491a
https://github.com/bugsink/bugsink/releases/tag/2.2.2
https://github.com/bugsink/bugsink/security/advisories/GHSA-5x67-j5xg-c5gj

Configurations

No configuration.

History

No history.

Information

Published : 2026-09-15 18:17

Updated : 2026-09-15 20:17

NVD link : CVE-2026-53954

Mitre link : CVE-2026-53954

CVE.ORG link : CVE-2026-53954

JSON object : View

Products Affected

No product.

CWE

CWE-400

Uncontrolled Resource Consumption

{"id": "CVE-2026-53954", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-53954", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-15T18:57:37.866602Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "bugsink", "product": "bugsink", "versions": [{"status": "affected", "version": "< 2.2.2"}]}]}], "published": "2026-09-15T18:17:22.393", "references": [{"url": "https://github.com/bugsink/bugsink/commit/1d0539fefcd1a796143d15d84053b1c0122ef8c7", "source": "security-advisories@github.com"}, {"url": "https://github.com/bugsink/bugsink/commit/8dca571b9e66c535ed4885465db820824e7c491a", "source": "security-advisories@github.com"}, {"url": "https://github.com/bugsink/bugsink/releases/tag/2.2.2", "source": "security-advisories@github.com"}, {"url": "https://github.com/bugsink/bugsink/security/advisories/GHSA-5x67-j5xg-c5gj", "source": "security-advisories@github.com"}], "vulnStatus": "Received", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-400"}]}], "descriptions": [{"lang": "en", "value": "Bugsink is a self-hosted error tracking tool. Prior to version 2.2.2, Bugsink stores every set of custom tags supplied with an incoming event, allowing a caller with a valid project DSN to submit an unusually large tag set and force excessive tag-row writes. Because Bugsink uses a single-writer database architecture, the expensive write transaction delays digestion of other events and causes a temporary ingestion denial of service. Version 2.2.2 applies the configurable MAX_EVENT_TAGS limit before storage. The impact is limited to availability for an instance accepting the event and does not expose stored data, modify existing events, or allow code execution. This issue is fixed in version 2.2.2."}], "lastModified": "2026-09-15T20:17:19.293", "sourceIdentifier": "security-advisories@github.com"}